Hi, I parse Mikrotik log vpn server and and encountered difficulties in applying the ecs for some fields. Exsample: vpn session time - the total time of VPN session vpn session rx bits or packets vpn session tx bits or packets or can i diff client public ip and client private ip ?

Hello, In ECS we don't have a clear concept of sessions, so you couldn't capture many details about a session. For session duration, however, you can use event.duration. This field is meant to capture the duration of any kind of event, so if you have a log event that reports the duration of a finis…

Use ecs with vpn server

Elastic Stack Elasticsearch

orsa (Pavel Kozlov) June 4, 2020, 1:42pm 3

Thank you very much, you helped me a lot!

I have a clarifying question.

Is it correct to assign the address issued by the DHCP servers (private ip vpn sessions) to source.nat.ip? Or was it supposed to be so when developing?

Topic		Replies	Views
Parsing Mapping and finding the right ECS fields for logs in general Logstash ecs-elastic-common-schema	2	896	March 2, 2021
Migrating pipelines to ECS Elasticsearch ecs-elastic-common-schema	3	565	August 2, 2019
Logstash parsing ECS Logstash ecs-elastic-common-schema	5	645	September 29, 2020
How Elastic common schema names are define for the log fields Elasticsearch ecs-elastic-common-schema	2	606	July 18, 2019
ECS - Squid proxy log normalization Elasticsearch ecs-elastic-common-schema	4	1792	August 14, 2019

Use ecs with vpn server

Related topics